Method and system for carrying out secondary encryption in full-link TLS encryption channel

Abstract

The invention discloses a method for carrying out secondary encryption in a full-link TLS encryption channel. The method specifically comprises the following steps: establishing a TLS communication link; generating a first secret key by using the current system time to serve as a key of an AES-256-GCM algorithm, encrypting data needing to be transmitted through the AES-256-GCM algorithm and the key, and then performing secondary encryption by using a user-defined algorithm to obtain a second ciphertext; after the second ciphertext is received, the second ciphertext is decrypted by a user-defined algorithm; and generating a second secret key by using the current system time, decrypting the first plaintext by using an AES-256-GCM algorithm and the second secret key as keys, if the decryption is unsuccessful, changing the time for generating the second secret key to regenerate the second secret key for decryption, and if the decryption is unsuccessful, discarding the second ciphertext and prompting an error. According to the method, the dynamic key and decryption fault tolerance are realized, the security is improved, keys which are managed in a unified manner are not needed, and the time difference can be dynamically controlled as long as the time is kept relatively consistent.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and specifically to a method and system for performing secondary encryption in a full-link TLS encrypted channel. Background Technology

[0002] Modern internet and systems with high security standards commonly use the TLS protocol for encrypted data transmission over the network, and establish TLS connections using RSA private keys of 2048 bits or more, or even more advanced ECDSA private keys of 256 bits or more.

[0003] Although the TLS protocol is very secure, it still has certain security risks in extreme situations, such as the private key files of the communicating parties being stolen through cyberattacks or the server room being physically hijacked. Therefore, when designing a high-security system, it is necessary to consider security fallback measures for extreme situations.

[0004] It is not uncommon to perform secondary encryption on data for high-level confidentiality. For example, Chinese patent document CN116455556A, entitled "An Interactive Method for Secondary Encryption of Data Transmission," includes: (1) encrypting client data and encrypting client browsing data once; (2) performing secondary encryption on transmitted data, agreeing on the secondary encryption key and time; (3) the server performs key judgment, judging the key and time; (4) monitoring transmitted data, realizing monitoring of browsing data duration; (5) verifying the key, performing sequential verification of the primary key and the secondary key; (6) the receiving end decrypts and restores the data, and restores the data after successful verification. Although the data is encrypted twice, the key is still transmitted through a public link, which still poses a risk of interception, allowing the data transmission to be intercepted or tampered with without being noticed by either party. Summary of the Invention

[0005] The purpose of this invention is to propose a method for secondary encryption in a full-link TLS encrypted channel to solve one or more technical problems existing in the prior art, or at least provide a beneficial option or create conditions.

[0006] To achieve the above technical objectives, the technical solution of the present invention is as follows:

[0007] Step 1: The sender and receiver of the data communication establish a TLS communication link; Step 2: Generate a first key using the sender's current system time. The first key is used as the key for the AES-256-GCM algorithm. The sender uses the AES-256-GCM algorithm and the key to encrypt the data to be transmitted to obtain the first ciphertext. Step 3: The first ciphertext is encrypted a second time using a custom algorithm to obtain the second ciphertext; Step 4: The second ciphertext is sent to the receiver through the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the custom algorithm to obtain the first plaintext. Step 5: Generate a second key using the receiver's current system time. Use the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, regenerate the second key according to predefined rules and try to decrypt again. If decryption fails, discard the second ciphertext.

[0008] Furthermore, in step 1, the sub-steps for the sender and receiver of data communication to establish a TLS communication link are as follows: The sender and receiver of data communication use standard RSA or ECDSA private keys and certificates to establish a standard TLS communication link.

[0009] Preferably, the standard TLS communication link is established on the TCP transport protocol.

[0010] Preferably, after establishing the standard TLS communication link, the sender and receiver of the data communication exchange the data transmission format.

[0011] Further, in step 2, a first key is generated using the sender's current system time. This first key serves as the key for the AES-256-GCM algorithm. The sub-step where the sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext is as follows: The first key is generated using the sender's current system time. The sender's current system time is obtained by using the API provided by the sender's operating system. If the length of the sender's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length.

[0012] Furthermore, the first key serves as the key for the AES-256-GCM algorithm, the Initialization Vector uses a fixed value, and the sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext.

[0013] Furthermore, the first ciphertext is encrypted a second time using a custom algorithm to obtain the second ciphertext.

[0014] Furthermore, the second ciphertext is sent to the receiver via the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the custom algorithm to obtain the first plaintext.

[0015] Preferably, the custom algorithm is ChaCha20-Poly1305 or RC4.

[0016] Preferably, the custom algorithm is a private algorithm.

[0017] The ChaCha20-Poly1305 algorithm is a new generation of stream encryption algorithm. Its pure software performance is higher than that of the AES algorithm, so that the additional encryption and decryption process will not consume a lot of CPU usage, while ensuring security.

[0018] Further, in step 5, a second key is generated using the receiver's current system time. The first plaintext is decrypted using the AES-256-GCM algorithm and the second key. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails again, the second ciphertext is discarded. The sub-steps are as follows: The second key is generated using the receiver's current system time. The receiver's current system time is obtained by using the API provided by the receiver's operating system. The Initialization Vector uses a fixed value. The second key is used as the key to decrypt the first plaintext using the AES-256-GCM algorithm. If the length of the receiver's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length. If decryption is successful and the obtained data is not garbled, then decryption is successful. If decryption fails or the decrypted data is garbled, then the receiver's current system time is moved forward by one interval, a second key is regenerated, and the first plaintext is decrypted again. If decryption fails or the decrypted data is garbled, then an error is reported, and the second ciphertext is discarded.

[0019] Preferably, the first interval is 1 minute.

[0020] An error could be attributed to a middleman tampering with the data during transmission, or to a data transmission failure.

[0021] The first interval can be used to control the tolerance of the time difference between the sender and receiver. The local time of both parties may have a certain error due to time correction issues, but in general, periodic NTP time correction is performed, and setting a time error of 1 minute is sufficient for this method to work perfectly.

[0022] Preferably, the decrypted data is garbled, meaning it does not conform to the data transmission format.

[0023] Preferably, when using the AES-256-GCM algorithm for decryption, an error is reported with an overwhelming probability when the key is incorrect. However, it is not impossible to detect a erroneous result without reporting an error. There is a probability that an erroneous key without reporting an error will be encountered when traversing all keys. In this case, the receiver may not be able to identify it (for example, some embedded platforms have insufficient processing power, insufficient RAM, insufficient ROM space to place the detection code, and high real-time requirements make it unsuitable to deploy too much judgment logic). By pre-agreeing on the data format, a simple verification can be performed on the decrypted data. For example, if the data format of a certain field is int, but a non-int value is obtained after processing, or the length of a certain field is inconsistent, it can be determined that a decryption error has occurred.

[0024] Preferably, the current system time of the sender and the current system time of the receiver are truncated to the minute, in the format yyyymmddhhm'm', where yyyy is a 4-digit year, mm is a 2-digit month, dd is a 2-digit day, hh is a 2-digit hour, and m'm' is a 2-digit minute.

[0025] Preferably, all undefined variables in this invention, if not explicitly defined, can be manually set thresholds.

[0026] Sender and receiver; The sender includes: Basic communication module: used to establish a TLS communication link, which is used to communicate with the receiver and send a second ciphertext; First encryption module: Used to generate a first key using the sender's current system time, and use the first key as the key for the AES-256-GCM algorithm to encrypt the data to be transmitted to obtain the first ciphertext; Secondary encryption module: used to encrypt the first ciphertext a second time using a custom algorithm to obtain the second ciphertext; The recipient includes: Basic communication module: used to establish a TLS communication link, which is used to communicate with the sender and receive the second ciphertext; First-level decryption module: After receiving the second ciphertext, it decrypts it using a custom algorithm to obtain the first plaintext; Secondary decryption module: Generates a second key using the receiver's current system time, and uses the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails, the second ciphertext is discarded.

[0027] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for secondary encryption in a full-link TLS encrypted channel provided in the first aspect of the present invention.

[0028] Fourthly, the present invention provides an electronic device, comprising: a memory storing a computer program thereon; and a processor for executing the computer program in the memory to implement the steps of the method for secondary encryption in a full-link TLS encrypted channel provided by the present invention.

[0029] AES-256 encryption and secondary encryption are performed again on the TLS link, combining the characteristics of both high-strength public and high-strength private algorithms. This ensures the system can still provide a security safety net even if the entire system is compromised but the source code is not leaked. The dynamically changing key technology and the unique time-based decryption fault-tolerance technology further enhance the security of the encryption. Even if the entire system is compromised, attackers cannot attempt brute-force cracking using a quantum computer. The dynamically changing key technology significantly reduces management and maintenance costs. The system does not need to uniformly manage constantly changing keys; all machines only need to maintain relatively consistent time, and the tolerance for time differences can be dynamically controlled. Attached Figure Description

[0030] Figure 1 A flowchart illustrating a method for performing secondary encryption in a full-link TLS encrypted channel provided by the present invention; Figure 2 This is a schematic block diagram of a system architecture for secondary encryption in a full-link TLS encrypted channel, according to an embodiment of the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. The specific embodiments described herein are only for explaining the invention and are not intended to limit the invention.

[0032] It should also be understood that the following embodiments are only used to further illustrate the present invention and should not be construed as limiting the scope of protection of the present invention. Any non-essential improvements and adjustments made by those skilled in the art based on the above description of the present invention are within the scope of protection of the present invention. The specific process parameters, etc., in the following examples are merely examples within a suitable range; that is, those skilled in the art can make appropriate selections within the range based on the description herein, and are not intended to be limited to the specific values ​​in the examples below.

[0033] The following exemplifies a method for performing secondary encryption in a full-link TLS encrypted channel provided by the present invention.

[0034] like Figure 1 The diagram shows a flowchart of a method for performing secondary encryption in a full-link TLS encrypted channel. The following section will combine... Figure 1 This invention describes a method for performing secondary encryption in a full-link TLS encrypted channel, comprising the following steps: Step 1: The sender and receiver of the data communication establish a TLS communication link; Step 2: Generate a first key using the sender's current system time. The first key is used as the key for the AES-256-GCM algorithm. The sender uses the AES-256-GCM algorithm and the key to encrypt the data to be transmitted to obtain the first ciphertext. Step 3: The first ciphertext is encrypted a second time using a custom algorithm to obtain the second ciphertext; Step 4: The second ciphertext is sent to the receiver through the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the custom algorithm to obtain the first plaintext. Step 5: Generate a second key using the receiver's current system time. Use the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, regenerate the second key according to predefined rules and try to decrypt again. If decryption fails, discard the second ciphertext.

[0035] In one embodiment, the sender and receiver of data communication establish a standard TLS communication link using standard RSA or ECDSA private keys and certificates.

[0036] The standard TLS communication link is established on the TCP transport protocol.

[0037] After establishing the standard TLS communication link, the sender and receiver of the data communication exchange data in JSON format.

[0038] The first key is generated using the sender's current system time. The sender's current system time is obtained by using the API provided by the sender's operating system. If the length of the sender's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length.

[0039] The following is a Python example program that extracts the current system time, concatenates it with a salt field, and outputs it as a key that meets the length requirement: import datetime # Get current time now = datetime.datetime.now() # Format the output by combining the year, month, day, hour, and minute into a single integer. time_formatted = int(now.strftime("%Y%m%d%H%M")) #Set a fixed salt value salt="AABBCCDDEEFFGGHHIIJJ" # Concatenate the value of key key= f"{time_formatted}{salt}" #Debug output print(key) If the key is 32 bits and the date is 16 bits, then the length of the custom salt is 20 bits.

[0040] Furthermore, the first key serves as the key for the AES-256-GCM algorithm, the Initialization Vector uses a fixed value, and the sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext.

[0041] Furthermore, the first ciphertext is encrypted a second time using the ChaCha20-Poly1305 algorithm to obtain the second ciphertext.

[0042] Furthermore, the second ciphertext is sent to the receiver via the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the ChaCha20-Poly1305 algorithm to obtain the first plaintext.

[0043] The ChaCha20-Poly1305 algorithm is a new generation of stream encryption algorithm. Its pure software performance is higher than that of the AES algorithm, so that the additional encryption and decryption process will not consume a lot of CPU usage, while ensuring security.

[0044] The second key is generated using the receiver's current system time. The receiver's current system time is obtained by using the API provided by the receiver's operating system. The Initialization Vector uses a fixed value. The second key is used as the key to decrypt the first plaintext using the AES-256-GCM algorithm. If the length of the receiver's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length. If decryption is successful and the obtained data is not garbled, then decryption is successful. If decryption fails or the decrypted data is garbled, then the receiver's current system time is moved forward by 1 minute, a second key is regenerated, and the first plaintext is decrypted again. If decryption fails or the decrypted data is garbled, then an error is reported, and the second ciphertext is discarded.

[0045] An error could be attributed to a middleman tampering with the data during transmission, or to a data transmission failure.

[0046] The first interval can be used to control the tolerance of the time difference between the sender and receiver. The local time of both parties may have a certain error due to time correction issues, but in general, periodic NTP time correction is performed, and setting a time error of 1 minute is sufficient for this method to work perfectly.

[0047] For devices that have not been updated for a long time, such as those lacking an NTP module, set the first interval to 10 minutes.

[0048] Preferably, the decrypted data is garbled, meaning it does not conform to the data transmission format.

[0049] Preferably, when using the AES-256-GCM algorithm for decryption, an error is reported with an overwhelming probability when the key is incorrect. However, it is not impossible to detect a erroneous result without reporting an error. There is a probability that an erroneous key without reporting an error will be encountered when traversing all keys. In this case, the receiver may not be able to identify it (for example, some embedded platforms have insufficient processing power, such as no hardware-accelerated encryption and decryption functions, limited RAM space, insufficient ROM space to place detection code, and high real-time requirements, so it is not advisable to deploy too much judgment logic). By pre-agreeing on the data format, a simple verification can be performed on the decrypted data. For example, if the data format of a certain field is int, but a non-int value is obtained after processing, or the length of a certain field is inconsistent, it can be determined that a decryption error has occurred.

[0050] Preferably, the current system time of the sender and the current system time of the receiver are truncated to the minute, in the format yyyymmddhhm'm', where yyyy is a 4-digit year, mm is a 2-digit month, dd is a 2-digit day, hh is a 2-digit hour, and m'm' is a 2-digit minute.

[0051] Preferably, all undefined variables in this invention, if not explicitly defined, can be manually set thresholds.

[0052] like Figure 2The diagram shown is a schematic block diagram of a system architecture for secondary encryption in a full-link TLS encrypted channel according to an embodiment of the present invention.

[0053] This invention provides a system for performing secondary encryption in a full-link TLS encrypted channel, the system comprising: Sender and receiver; The sender includes: Basic communication module: used to establish a TLS communication link, which is used to communicate with the receiver and send a second ciphertext; First encryption module: Used to generate a first key using the sender's current system time, and use the first key as the key for the AES-256-GCM algorithm to encrypt the data to be transmitted to obtain the first ciphertext; Secondary encryption module: used to encrypt the first ciphertext a second time using a custom algorithm to obtain the second ciphertext; The recipient includes: Basic communication module: used to establish a TLS communication link, which is used to communicate with the sender and receive the second ciphertext; First-level decryption module: After receiving the second ciphertext, it decrypts it using a custom algorithm to obtain the first plaintext; Secondary decryption module: Generates a second key using the receiver's current system time, and uses the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails, the second ciphertext is discarded.

[0054] The system described above, which performs secondary encryption in a full-link TLS encrypted channel, can run on computing devices such as desktop computers, laptops, PDAs, and cloud servers. The system that can run on this system may include, but is not limited to, processors and memory. Those skilled in the art will understand that the example described is merely an illustration of a system performing secondary encryption in a full-link TLS encrypted channel and does not constitute a limitation on such a system. It may include more or fewer components, or a combination of certain components, or different components. For example, the system may also include input / output devices, network access devices, buses, etc.

[0055] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the system operating under the described system for secondary encryption in a full-link TLS encrypted channel, connecting various parts of the system through various interfaces and lines.

[0056] The memory can be used to store the computer program and / or modules. The processor implements various functions of the system for secondary encryption in a full-link TLS encrypted channel by running or executing the computer program and / or modules stored in the memory, and by calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include random access memory (RAM), and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0057] Although the invention has been described in considerable detail and particularly with regard to several of the described embodiments, it is not intended to limit itself to any of these details or embodiments or any particular embodiment, thereby effectively covering the intended scope of the invention. Furthermore, the invention has been described above with respect to embodiments foreseeable by the inventors in order to provide a useful description, and non-substantial modifications to the invention that have not yet been foreseen may still represent equivalent modifications.

[0058] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0059] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention.

Claims

1. A method for performing secondary encryption in a full-link TLS encrypted channel, characterized in that, The method includes the following steps: Step 1: The sender and receiver of the data communication establish a TLS communication link; Step 2: Generate a first key using the sender's current system time. The first key is used as the key for the AES-256-GCM algorithm. The sender uses the AES-256-GCM algorithm and the key to encrypt the data to be transmitted to obtain the first ciphertext. Step 3: The first ciphertext is encrypted a second time using a custom algorithm to obtain the second ciphertext; Step 4: The second ciphertext is sent to the receiver through the TLS communication link. After receiving the second ciphertext, the receiver decrypts it using the custom algorithm to obtain the first plaintext. Step 5: Generate a second key using the receiver's current system time. Use the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, regenerate the second key according to predefined rules and try to decrypt again. If decryption fails, discard the second ciphertext.

2. The method for secondary encryption in a full-link TLS encrypted channel according to claim 1, characterized in that, In step 1, the sub-step for the sender and receiver of data communication to establish a TLS communication link is as follows: the sender and receiver of data communication establish a standard TLS communication link using standard RSA or ECDSA private keys and certificates.

3. The method for secondary encryption in a full-link TLS encrypted channel according to claim 2, characterized in that, The standard TLS communication link is established on the TCP transport protocol.

4. The method for secondary encryption in a full-link TLS encrypted channel according to claim 1, characterized in that, In step 2, a first key is generated using the sender's current system time. This first key serves as the key for the AES-256-GCM algorithm. The sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext. The sub-steps are as follows: The first key is generated using the sender's current system time. The sender's current system time is obtained by using the API provided by the sender's operating system. If the length of the sender's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length. The first key is used as the key for the AES-256-GCM algorithm. The Initialization Vector uses a fixed value. The sender encrypts the data to be transmitted using the AES-256-GCM algorithm and the key to obtain the first ciphertext.

5. The method for secondary encryption in a full-link TLS encrypted channel according to claim 1, characterized in that, The sender's current system time and the receiver's current system time are truncated to the minute, in the format yyyymmddhhm'm', where yyyy is a 4-digit year, mm is a 2-digit month, dd is a 2-digit day, hh is a 2-digit hour, and m'm' is a 2-digit minute.

6. The method for secondary encryption in a full-link TLS encrypted channel according to claim 1, characterized in that, In step 5, a second key is generated using the receiver's current system time. The first plaintext is decrypted using the AES-256-GCM algorithm and the second key. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails again, the second ciphertext is discarded. The sub-steps are as follows: The second key is generated using the receiver's current system time. The receiver's current system time is obtained by using the API provided by the receiver's operating system. The Initialization Vector uses a fixed value. The second key is used as the key to decrypt the first plaintext using the AES-256-GCM algorithm. If the length of the receiver's current system time does not meet the length requirement for the AES-256-GCM algorithm key, a custom salt is used to fill the key to the required length. If decryption is successful and the obtained data is not garbled, then decryption is successful. If decryption fails or the decrypted data is garbled, then the second key is generated by moving the receiver's current system time forward by one interval and then decrypting the first plaintext again. If decryption fails or the decrypted data is garbled, the receiver's current system time is shifted forward by one interval to regenerate the second key and then the first plaintext is decrypted again. If decryption fails or the decrypted data is garbled, an error is reported and the second ciphertext is discarded.

7. A method for secondary encryption in a full-link TLS encrypted channel according to claim 6, characterized in that, The first interval is 1 minute.

8. A system for performing secondary encryption in a full-link TLS encrypted channel, characterized in that, The system includes: Sender and receiver; The sender includes: Basic communication module: used to establish a TLS communication link, which is used to communicate with the receiver and send a second ciphertext; First encryption module: Used to generate a first key using the sender's current system time, and use the first key as the key for the AES-256-GCM algorithm to encrypt the data to be transmitted to obtain the first ciphertext; Secondary encryption module: used to encrypt the first ciphertext a second time using a custom algorithm to obtain the second ciphertext; The recipient includes: Basic communication module: used to establish a TLS communication link, which is used to communicate with the sender and receive the second ciphertext; First-level decryption module: After receiving the second ciphertext, it decrypts it using a custom algorithm to obtain the first plaintext; Secondary decryption module: Generates a second key using the receiver's current system time, and uses the AES-256-GCM algorithm and the second key as the key to decrypt the first plaintext. If decryption fails, the second key is regenerated according to predefined rules for decryption. If decryption fails, the second ciphertext is discarded.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of a method for secondary encryption in a full-link TLS encrypted channel as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, include: A memory on which computer programs are stored; A processor for executing the computer program in the memory to implement the steps of the method for secondary encryption in a full-link TLS encrypted channel as described in any one of claims 1 to 7.

Images